diff --git a/server/requirements.txt b/server/requirements.txt
index 2f39bf2d..56b398ce 100644
--- a/server/requirements.txt
+++ b/server/requirements.txt
@@ -3,7 +3,7 @@
 anndata>=0.7.6 # we need to_memory(), added in 0.7.6
 boto3>=1.12.18
 click>=7.1.2
-Flask>=1.0.2
+Flask>=1.0.2,<2.3.0
 Flask-Compress>=1.4.0
 Flask-Cors>=3.0.9  # CVE-2020-25032
 Flask-RESTful>=0.3.6